Sudipta Chattopadhyay

SLICK: Securing Embedded Software against Information Leakage

Principal Investigator (PI):

Asst. Prof. Sudipta Chattopadhyay

External Collaborators:

Open Position:

I am always hosting visitors and interns at all levels (Bachelor, Masters and PhDs) in this project. If interested, contact the PI (Sudipta Chattopadhyay) directly with your CV.

The Context:

Embedded systems play a crucial role in our daily life, starting from consumer devices (e.g. smartphones) to advanced automotive systems (e.g. electric cars). In the past decade, we have seen an increasing trend of such embedded systems being connected to the cyber-space. This includes, cyber-physical systems, connected cars and Internet-of-Things (IoTs) among others. As an immediate consequence, these systems are now exposed to cyber attacks. For instance, a third-party observer may launch an attack to compromise such systems when sensitive information is (accidentally) leaked to her. It is, therefore, of critical importance to validate these systems against potential information leakage and design appropriate countermeasures to reduce information leak.

The Research Scope:

In this project, we will investigate systematic methodologies to discover and assess information leakage scenarios in embedded software systems. Subsequently, we will build upon the obtained results to reduce the leakage of sensitive information. A particular emphasis of our project will be on side-channel attacks, which can retrieve sensitive information from non-functional system properties, such as timing, power consumption and memory footprint. From a broader perspective, we aim to investigate the following research questions:

  • For a given scenario (e.g. an execution trace or a use-case), how much (sensitive) information is leaked to a potential attacker? To investigate this, we will leverage some existing and realistic models of attackers and quantify the information leak with respect to such attacker models.

  • For a given system (e.g. a stand-alone program or a networked system such as IoT), how do we validate or certify them against potential information leakage? We plan to build novel techniques and tools for such validation. This includes building a generic framework to assess the information leakage of systems under test. Subsequently, we leverage this framework to discover concrete scenarios (e.g. a use case or an execution trace) that may leak sensitive information.

  • How do we design appropriate countermeasures to protect the current-generation embedded systems against potential attacks? Often embedded systems involve low-end devices (e.g. in IoTs) that are resource constrained and pose several other constraints related to timing and power consumption. Therefore, it is not feasible to directly translate countermeasures used in mainstream devices (e.g. desktop machines) to embedded systems. We will devise novel techniques, tailored for resource-constrained systems, in order to reduce information leak as well as detecting the presence of attacks in-vivo. A newly detected attack will further be translated to our model and its cause can be analyzed manually for future prevention.

This project will investigate both the theoretical and the practical aspects of the underlying research problem. From the theoretical side, we will build new models and techniques to discover information leak in current-generation embedded systems. From the practical side, the project will investigate the feasibility of a concrete attack, based on the results obtained from our models and analysis, on a realistic system. For this project, we plan to use the IoT Testbed at the Research and Security Innovation Lab for IoT.

Publications from SLICK:

Related Publications: